RenewRoster REST API

REST APIMCP serverOpenAPI 3.1 spec

Every RenewRoster account, free or paid, can use the API to read and manage the domains and SSL certificates it tracks. Base URL: https://app.renewroster.com/api/v1. Requests and responses are JSON.

Authentication

An agency owner creates keys in the dashboard under API. A key belongs to one agency and can only see that agency's data. Pick Read-only or Read + write when you create it. The key is shown once; we store only a hash. Revoke a key at any time from the same page.

curl -H "Authorization: Bearer rr_live_xxxxxxxxxxxx_yourSecret" https://app.renewroster.com/api/v1/me

Missing, invalid or revoked keys get 401. Using a read-only key on a write endpoint gets 403.

Rate limits

Responses include X-RateLimit-Limit. Over the limit you get 429 with Retry-After (seconds). POST /assets/{id}/check is also limited to 30 per hour per key and once a minute per asset.

Endpoints

Dashboard-only

For security these stay in the dashboard and are not available through the API or MCP: billing, plan changes, checkout and invoices; inviting members and changing roles; deleting the agency; creating or revoking API keys; agency branding; and admin operations. Webhook secrets are shown only once, when the webhook is created.

Errors look like {"error":"message"} with a 4xx status. The full schema is in the OpenAPI 3.1 spec.

Examples

# What expires in the next 30 days?
curl -s -H "Authorization: Bearer $RR_KEY" "https://app.renewroster.com/api/v1/expiring?days=30"

# Only SSL certificates that already expired
curl -s -H "Authorization: Bearer $RR_KEY" "https://app.renewroster.com/api/v1/assets?type=ssl&status=expired"

# Track a domain for a client (read + write key)
curl -s -X POST -H "Authorization: Bearer $RR_KEY" -H "content-type: application/json" \
  -d '{"type":"domain","name":"example.com","clientName":"Acme"}' https://app.renewroster.com/api/v1/assets

# Remind 30 and 7 days before domain expiry
curl -s -X PUT -H "Authorization: Bearer $RR_KEY" -H "content-type: application/json" \
  -d '{"domainDays":[30,7]}' https://app.renewroster.com/api/v1/reminders

Each asset includes type, name, expiresAt, daysLeft, status (expiring means 30 days or less), registrar or issuer, clientId and the last check time and error.

Webhooks

Add webhooks with the API or in the dashboard. Endpoints must be public https:// URLs on port 443. Events:

POST /your/endpoint
Content-Type: application/json
X-RenewRoster-Event: asset.expiring
X-RenewRoster-Delivery: 2f6c…
X-RenewRoster-Signature: t=1767225600,v1=5b1f…

{"id":"2f6c…","event":"asset.expiring","createdAt":"2027-01-01T02:17:00.000Z","agencyId":"…",
 "data":{"asset":{"id":"…","type":"domain","name":"example.com","expiresAt":"2027-01-31T00:00:00.000Z","daysLeft":30},"threshold":30}}

Return any 2xx within 10 seconds. Otherwise we retry after 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours, then mark the delivery failed. Use X-RenewRoster-Delivery to ignore duplicates.

Verifying signatures

The signature is HMAC-SHA256(secret, t + "." + rawBody) in hex. Compute it over the raw request body, compare in constant time, and reject timestamps older than 5 minutes.

// Node.js
import { createHmac, timingSafeEqual } from "node:crypto";
export function verify(rawBody, header, secret) {
  const parts = Object.fromEntries(header.split(",").map(p => p.split("=")));
  if (Math.abs(Date.now() / 1000 - Number(parts.t)) > 300) return false;
  const expected = createHmac("sha256", secret).update(`${parts.t}.${rawBody}`).digest("hex");
  return expected.length === parts.v1.length && timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}

# Python
import hmac, hashlib, time
def verify(raw_body: bytes, header: str, secret: str) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    if abs(time.time() - int(parts["t"])) > 300:
        return False
    expected = hmac.new(secret.encode(), f"{parts['t']}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts["v1"])

<?php // PHP
function rr_verify(string $raw, string $header, string $secret): bool {
  parse_str(str_replace(',', '&', $header), $p);
  if (abs(time() - (int)$p['t']) > 300) return false;
  return hash_equals(hash_hmac('sha256', $p['t'] . '.' . $raw, $secret), $p['v1']);
}

Use it from AI assistants

The same keys work with our remote MCP server for Claude, Cursor, VS Code and Windsurf.